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by Vincent R. Lalli 
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Cleveland j Ohio 

INTRODUCTION 

The outline shown below describes the material that will be covered 
in the Reliability Testing and Demonstration Lectures IV C,E: 

IV B. Application of Statistical Methods 
■ 1. Testing with normal units 
2. Determination of confidence limits 
3- Testing with lognormal units 

4 . Determination of confidence limits 

5. Testing with bionomial and Poisson events 

6. Determination of confidence limits 
IV E . Reliability Program Case History 

1. SERT II Reliability engineering 

2. Reliability stress analysis of a microthruster power 

conditioner 

A great deal of work has been done by various researchers to develop 
mathematical concepts suitable for reliability studies. The interested 
reader should consult References 1 through 4 for additional details 
pertaining to statistical methods for discrete and continuous random 


variables. 
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In these notes effort will be concentrated on four functions; 

(l) Failure, f(t); (2) Reliability, R(t); Failure rate, Aj and 
(4) Hazard rate, A'. Since it is usually important to know how well 
a point estimate has been defined, some consideration will be given to 
calculation of confidence limits for normal, lognormal, bionomial and 
Poisson functions. These notes consider specific cases to show how 
analytical or graphical statistical methods can be used in summarizing 
test data. 

1. Testing with normal units (analytical procedure) 

A mechanical part is being used where friction, mechanical loading 
and temperature are the principal failure causing stresses. Assume 
that tests to failure have been conducted for these mechanical parts re- 
sulting in the data shown in table I. 

(a) Calculate the mean-time-between-failures and standard deviation. 

(b) What are the hazard rate at 85-3 K hours and failure rate dur- 
ing the next 10.3 K hour interval? 

(c) What are the failure and reliability time functions? 

The mean-time-between-failures and standard deviation can be calcu- 
lated for the data given in table I as follows; 
n 

( a ) t = 


where 
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t mean- time-between- failures; hr 

t f time-o-failure, hr 

n number of observations 

therefore, using the data from table I 


t = = 75 K hours 


and 



where c r = unbiased standard deviation 




= 5.?213x 10 4 (K hr) 2 


column 3? table I, 



= (7.5xl0 2 ) 2 


5.625 x 10 5 (k hr) 2 


Therefore, 



4 


cr 


( ; 


57213 - 562 go 
9 


;Y /2 



= 10.3 K hr 


(b) The hazard rate, 7\ 


and failure rate A are calculated as 


follows : 


ji _ normal ordinate at 85.3 K hr 
normal area § 5.3 K hr to 

Let Y^ = normal ordinate at 85.3 K hr 
Zj = standardized normal variable 


t - t _ (85.3 - 75.0) K hr 
cr ~ 10.3 K hr 


+1.0 


Table 4 (p. 352 of ref. 5) for Z = +1.0 gives Y^ = 0.242. The scale 
constant K g for this problem is: 


where 9 = class interval 

h - f <V - Vl ■ mjlfr * °- 242 " 2-35X10- 1 * F/hr 

Let R(t^) = normal area 85.3 hr to . From table 3 (p* 351 of 
ref. 5) for Z ^ - +1.0 

Q(t^) = 0.84l area from -<*» to Z^ 

Since Q(t x ) + R(t 1 ) - 1.000 
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R(t,) = 1.000 - 0.841 = 0.159 


1 = 2,3 ^ x1 -" • = 1.47xlO" 3 Failures/hr 

1.59xl0" x 


and. 


A = 


1 - 


R(t 2 ) 

rT^T 


h - 10.3 K hr 


R(tr>) = normal area 95*6 K hr to 


z = i2U>. ,^,o 

l 2 10.3 K hr d,u 


From table 3, Q(t 2 ) - 0.977 and R(t g ) = 0.023 


A » 


ioTFS ( x - £lf) - f^T - 8 - 32x10 ' 5 ~Wte 


(c) The constants for f(t) and R(t) are calculated as follows: 


o-V^ir 1.03x10 x 2.52 


- 3- 87x10“ 5 


2a 2 = 2 x (1. 03x10^) 2 - 2.12X10 8 


Therefore, 


f(t) = 3. 87x10“ ^ e 


-5 -(t-7.5xl0 4 ) 2 /2.12xl0 8 
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R(t) = 3-87x10' 


f- 


- ( t - 7 . 5 x 10 ^ ) 2 / 2 . 12 x 10 ^ dt 


2. Determination of parameters and confidence limits 

Twenty-five (25) mechanical parts have been tested to failure. 
The mean-time-between failures has been calculated to be 75 K hours 
with o- = 10.3 K hours (see problem l). (a) What are the upper and 

lower confidence limits at a 90 percent confidence level? 

The upper and lower confidence limits are given by: 


U = t + K 


’a / 2 



where 

t mean-time-between failures •> hr 

normal coefficient 

cr unbiased standard deviation ? hr 

n number of samples 

CL 

7 ? area under one tail 


For this problem: 

l - a - 0,90 a - 0.10 | = 0.05 
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K a/ / 2 « 1.64 from table 3 of reference 5 

U = 75 K + 3r — • - = 78.4 K hr 

V25 

L = 75 K - 1 — x -3~ - . 71.6 K hr 
t/25 


This means that 90 percent of the time the mean-time-between- 
failures estimate t for problem 1 with a larger sample size will be 
between 71 600 and 78 400 hours. It should be noted that the sample 
size for problem 1 was only 10 parts, If possible, try to keep 
n > 25 for estimating normal parameters with the above equations. 

If the sample size, n < 2 5 then use should be made of the stu- 
dent's t distribution (see ref. 6). If problem 2 is reworked for a 
smaller sample size of 10, it will be interesting to see the effect that 
sample size has on the size of confidence intervals. 


U 


t + t 


a 


s 



L - t - 



where 

t student t coefficient 

s standard deviation, hr 

For this case with a = 0.10, v - n - 1 = 10 - 1 = 9 
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t =1.83 from table IV of reference 6, page 243 

. = ( \ 9 .82 K hr 

U « 75 K hr + = 80.7 K hr 

yio 

L = 75 K hr - 1,83 x 9/82 ... K hr = g 9>3 K hr 

yTo 

It will be noted that the smaller sample size gives a larger in- 
terval of uncertainty for t. 

3* Testing with lognormal units (graphical procedure) 

A cable used as guy supports for sail experiments in wind tunnel 
testing exhibited the time-to-failure performance data given in table II. 

(a) "Write the failure and reliability functions. 

(b) What is the hazard rate at 5715 hours? 

(c) what is the failure rate during the. next 3000 hours? 

a. The essential steps for solving this problem are given below: 

(1) Table II gives the median rank for each ordered position. 

(2) Plot on lognormal probability graph paper (probability x 

2 log cycles) median ranks against failure age as shown in figure 1. 

(3) If a straight line can be fit to these plotted points, then 
the time-to-failure function is lognormal. 

(4) The mean-time-between-failures is calculated by t' = log (t) 
where t = 6970 hours as shown in figure 1 for a median ranks of 50 
percent, hence t' = 8.84. 
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(5) The standard deviation is calculated by 


a t’ = 


l°S e ty - lOg e t L 


where t 7T = 49 500 hours and t T = 1020 hours as shown in figure 1 for 
U h 

a median and [l - rank] of 93*3 percent; hence 


= 1.29. 


Using these constants the expressions for f(t) and R(t) can be 
obtained. 


f ( t ) „ 3.07X10 " 1 e -(t'-8.84) 2 /^.32 


R(t) = 3.07x10 


-/ 


e -(t' -8.84)73.32 dt 


log e (t) 


b. The lognormal ordinate required for A 1 can be calculated as follows: 


•N) 


(8.66 - 8.84' 


-C.139 


^ = 0.395 from table 4 of reference 5 


V — ^ A w * *. 

2 " a t , = 1.29 


f(t’) = t— — = 5 . 34x10 ^ Failures/hr 

5.715x10^ 
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The lognormal area from t' to infinity can be obtained directly 
from figure 1 using the [1 - rank] scale. Enter the t ime -to- failure 
ttf ordinate at 5715 hours 3 project over to the lognormal life function 
Q(t) and down to the [1 - rank] abscissa value of O.638. Therefore the 
hazard rate A' at 5715 hours is: 

A' - g,3ifx10 ' T - 8.36x10“ 4 Failures/hr 

6.38x10 

c. The failure rate during the next 3000 hours is calculated knowing 

the R(t 1 ) = O.638 at ttf = 5715 hours and obtaining R(tg) = 0.437 
from figure 1 at ttf = 8715 hours. Therefore, 

A = — -i-s [X - g i g ) - 1.05x10'^ Failures/hr 
3xl0 3 ° 753S / 

4. Determination of confidence limits 

It has been shown that the guy supports of problem 3 exhibited a 
reliability of 0.638 at a ttf of 5715 hours. Consider now the pro- 
cedure for determining the confidence band on this lognormal estimate. 
The data needed for the graphical construction of the 90 percent conr 
fidence lines on the lognormal graph of figure 1 is also given in table 
II. The steps necessary to graphically construct the confidence lines 
in figure 1 are as follows: 

(l) Enter the ranks axis with the first 5 percent rank value 
hitting Q(t) the lognormal life function shown in figure 1; ordered 
sample number 3, 5 percent rank 8.7. 
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(2) Draw a vertical line to intersect Q(t) at point 1 as shown 
in figure 1 . 

(3) Draw a horizontal line to cross the corresponding median 
rank; ordered sample number 3 , median rank 25 * 9 * 

(4) The intersection point (point 2 in fig. l) of step 3 and the 
median rank line is one point on the 95 percent confidence line. 

(5) Repeat steps 1 through 4 until the desired time-to-failure 
is covered, 5715 hours in this case. 

( 6 ) The 5 percent confidence line is obtained in a similar 
manner. Enter the ranks axis with the 95 percent failure rank, 25.9 
for ordered sample number 1 . 

(7) Draw a vertical line which intersects Q(t) at point 3 . 

(8) Draw a horizontal line to cross the corresponding median 
rank; ordered sample number 1, median rank 6 . 7 . 

(9) The intersection point (point 4 in fig. l) of these two lines 
is one point on the 5 percent confidence line. 

(10) Repeat steps 6 through 9 until the desired time-to-failure 
is covered. 

At 5715 hours the 90 percent confidence interval for Q(t) is 
from figure 1: 19.7 percent, 69.4 percent. Hence, a 90 percent con- 
fidence interval for R(t) at 5715 hours is O.803 to O.306. Inci- 
dentally, this graphical procedure for finding confidence intervals is 
completely general and can be used on other types of life test dia- 


grams. 
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5. Testing with the binomial and Poisson events 

The binomial and Poisson distributions are discrete functions of 
the number of failures which occur rather than time t. A summary 

of these frequency functions is given in figure 1 of reference 4. 

A suspicious lot of explosive bolts is estimated to be 15 percent 
defective due to improper loading density observed in neutron radiog- 
raphy. 

(a) Calculate the probability of one defective unit appearing in 
a flight quantity of four. 

(b) Plot the resulting histogram. 

(c) What is the reliability from the first defect? 

Not much failure density data is available, however, past experience 
with pyrotechnic devices has shown that the binomial distribution applies. 
Prom the given data: 

q per unit number of effectives = O.85 
p per unit of defectives =0.15 

n sample size = 4 

N f possible number of failures = 0, 1, 2, 3, 4 
The frequency functions corresponding to these constants are given 
below: 


f(N f ) 


n! 

In - N f )T N f ! 



n-N f 

q. 


f(N f ) = 


4: 

(4 - N f )i N f ! 



4-N f 

<1 
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n 


r(V - Y) 


nl n n-j 

(n - 1) ! H P q 



li* 

TV- 3'5"! Ji 




One easy method to obtain the binomial expansion coefficients is 
to make use of Pascal's triangle. Pascal found that there was symmetry 
to the coefficient development and explained it as shown in table III. 
Column 1 gives the sample size n. Column 2 gives the possible number 
of failures. Column 3 gives the binomial expansion coefficients. The 
numbers in the dashed triangle in column 3 are obtained by adding the 
two numbers above the number to get that number; that is, refer to 
dashed insertion the triangle 3 + 3 = 6. In expanded form f(Nj.) be- 
comes 


f(N f ) = q^ + 4q 3 p + 6q 2 p 2 + 4qp 3 + p^ 

The probability of one defective unit appearing in the flight 
quantity of 4 is given by the second term in the expansion; hence, 

4q 3 p « 4(0.85) 3 (0.15) = 0.37 

The resulting histogram for this distribution is shown in figure 2. The 
probability that 2, 3, or 4 defects will occur as the reliability from 
the first defect is the sum of the remaining terms in the binomial ex- 
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pansion. This probability can be calculated using the following equa- 
tion: 



4: j 

(4 - ITT J! p 



However, it is simpler to use the histogram graph and sum the proba- 
bility defects over from 2 to 4. Hence, 

R(2) = O.O96 + 0.011 = 0.108 

These explosive bolts in their present form are not suitable for use on 
a flight spacecraft as the probability of zero defects is only 0.522 
much below the usually desired 0.999 for pyrotechnic spacecraft devices. 

The Poisson distribution is used to determine the probabilities 
associated with a specified number of failures in the continuum of time. 
Complex electrical components have been shown to follow the Poisson 
distribution. 

Ten space power speed controllers were tested during the Sun- 
flower development program. The time-to- failure test data is given in 
table IV. 

(a) Write the Poisson failure density and reliability functions. 

(b) What is the probability of five failures in 10 000 hours? 

(c) What is the probability that 6, 7> 8, 9s or 10 failures will 
occur or the reliability from the 5^ failure? 
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a. Using the data given in table IV, this problem can be solved as 
follows : 


1U 

Eh 


t = — = 8.59xl0 3 hr/failures 

N f 1U 


Hence the Poisson failure density function is; 


f(N f ) 




-t/8.59xl0 3 


and the reliability function is: 


R(N f ) 


10 

X) 


LQ 3 )^ -t/8. 59xl0 3 


b. The probability of five failures f(5) in 10 000 hours makes use of 
the ratio (t/t). Using this ratio, f(5) becomes 


t__ = 1.0x10 
t 8.56 x10 3 


= 1.16 


, (1.16)^ e~ 1,16 = 2.09 x 0.314 = 5>U7xl0 -3 
55 1.2xl0 2 


Orxe easy method to .calculate the term (l.lGy is as follows; 


log (1.16) 5 = 5 log 1.16 = 5(0.148) - 0.740 
(1.16) 5 = 2.09 
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"til *ttL 

c . The reliability from the 5 to the 10 failure is the sum of the 
remaining terms in the Poisson expansion. This probability can be 
calculated using the following equation 


10 


3=6 


R(6) = 0.0013 


6. Determination of confidence limits- 

When an estimate is made using discrete distributions, it is ex- 
pected that additional estimates of the same parameter will be close to 
the original estimate. It is desirable to be able to determine upper 
and lower confidence limits at some stated confidence level for dis- 
crete distribution estimates. The analytical procedure for determining 
these intervals is simplified by using specially prepared tables and 
graphs. Useful tables for the binomial distribution are given in 
references 8, 9> and 10. 

A prior calculation showed that the probability of one defective 
pyrotechnic unit appearing in a flight quantity of four was 0.37* 

•v, vyr 

What are the upper and lower confidence limits on this estimate at 
a 90 percent confidence level? 

If the number of defectives is r and the confidence level £s 7, 
this problem has the constraints listed below: 


n = 4 r = 1 7 = 9 0 percent 


Using these constraints, the upper U and lower L confidence limits 
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can be obtained from table I in reference 8. 

L = 0.026 

U = 0.680 

This means that with a 90 percent confidence the probability of one 
defective bolt appearing in a flight quantity of four is in the interval 
from 0.026 to 0.680. 

The Poisson estimate of reliability from the 5th to the 10th failure 
for speed controllers was found to be 0.0013 in a previous problem. What 
are the uppgr and lower confidence limits on thin estimate at a 95 percent 
confidence level? 

The variation in t can be found by using Chart I , page 23 from 
reference 10, Enter Chart I on the 5 percent line at the left hand end 
of the 5 interval, here T/t^ = 10.5, then = 10 t/T/t^ = 

8. 57x10^/10.5 = 8l60 hours. Using the left hand end of the 4 interval 
T/tg = 9 ,2 5j then t g = 8. 57x10^/9 • 25 = 9530 hours. One easy method to 
find Q(5) is to use figure 6-1 of reference 5, page 6l. The t/t 
ratios of interest are 1.22, 1.16, and 1.05, respectively. For these 
ratios with = 5, the values of Q(5) from figure 6-1 are 0.997, 
O.9987, and 0.9992, respectively. Since the sum of the last five terms 
is desired, IU5) is 0.003, 0.0013, and 0.0008, respectively. 

This means that the probability of the 5th to the 10th failure of 
a speed control occurring is in the interval from 0.0008 to 0.003 at a 
confidence level of 95 percent. 
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IV E. Reliability Program Case History 

The Lewis Research Center’s reliability engineering programs are 
designed to require; 

1. Through planning and effective management of the reliability 
assurance effort. 

2. Definition of the major reliability engineering tasks and their 
place as an integral part of the design and development process. 

3. Assurance of reliability through a complementary program of 
reliability engineering and evaluation. 

1.0 SERT II Reliability engineering 

A reliability engineering effort was established and maintained to 
assure that the complete space system, launch vehicle, spacecraft and 
associated ground support equipment are capable of meeting th® SERT II 
objectives. 

The SERT II design concept is strongly influenced by the philosophy 
of maximum utilization of previously space qualified hardware, of system 
redundancy, and of extensive endurance testing of a complete spacecraft 
under simulated mission conditions. With few exceptions new design is 
limited to supporting on-board experiments of secondary mission criticality. 
For all new designs minimum parts derating factors were employed. For 
newly designed critical components, a review of such factors as complexity, 
exposure to transients, redundancy, and the scope and depth of the planned 
test program were used to determine the need for formal stress analysis. 
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Similar considerations were given to the need for formal failure mode, 
effect and criticality analysis. 

Design review 

Formal design reviews conducted by the Project did include partici- 
pation by R&QAO personnel. The R&QAO did provide an independent 
appraisal of the design under consideration giving special attention to 
its reliability performance. These R&QAO representatives did provide 

V 

follow-up action on items related to reliability areas of concern. 

Failure mode, effect and criticality analysis 

Projected analyses for newly designed critical systems was developed 
to determine possible modes of failure and their effect. The primary 
objective of these analyses was to discover critical failure areas and 
remove susceptibility to such failures from the system. In the analyses, 
each potential failure was considered in the light of probability of 
occurrence and was categorized as to probable effect on mission success 
of the system to aid in proportioning effort for corrective design action. 
These analyses were a major consideration in design reviews and also pro- 
vided an important criterion for test planning. 

Reliability modeling 

A reliability prediction model was made to show that the system is 
capable of meeting the specified MTBF goals. Each functional device, 
input, output, internal and external connection point and boundary was 
shown in a system block diagram. The model was revised as required by 
evaluation of the design, design changes, and test data. This model was 
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used as: 

a. A basis for redundancy. 

b. A guide for reliability improvements. 

c. A guide for failure data reporting and analysis. 

Parts and materials selection 

The R&&A0 did support the Project Office in selection, reduction 
in number of types, specifications, qualification and application review 
of parts and materials. R&QAO did review nonstandard parts (i.e., parts 
selected from sources other than preferred parts lists) and recommend 
their suitability for use Oh program hardware. 

Stress analysis 

Newly designed critical components and subsystems were studied 
analytically and experimentally to determine the electrical, mechanical 
and thermal stresses to verify that the designs have adequate derating 
factors for spacecraft use. Steady state and transient stress were 
measured. Operating magnitude or shutdown were studied to determine worse 
case conditions. 

In cases where the derating factors cannot be achieved, a derating 
factor nonconformance list was prepared. This list was reviewed by 
R&QAO and recommendations for corrective action submitted to the Project 


Manager . 



21 


Electrical 

Electrical measurements were made on the developmental model 
in a laboratory environment. This survey did measure the voltage, 
current and power for parts operating at over 50 percent of their 
rating or dissipating more than 0.5 watts. 

Thermal 

A preliminary thermal survey was conducted on the developmental 
models in a laboratory environment. This survey did measure the 
surface or case temperature of each critical or questionable part. 

A second thermal survey was conducted on the prototype models 
mounted to demonstrate compliance with flight environmental speci- 
fications. 

Mechanical 

A mechanical survey was cpnducted on the prototype models 
mounted to demonstrate proper derating for shock, vibration and 
acceleration in compliance with flight environmental specifications. 

Failure, reporting, analysis and corrective action 

An integrated effort was established for failure reporting on 
tests conducted with flight and prototype hardware and with selected 
developmental hardware agreed to by the SERT II Project Manager. 
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Failure reporting 

Provisions were established for the organized reporting of 
failures resulting during selected developmental, acceptance, 
qualification and life tests, at the component, sub-system and 
system level. The pertinent information relevant to the failure 
of the item was furnished to all groups requiring such information. 

Failure analysis 

The failure analysis of the article was conducted by the 
appropriate design engineer responsible for the component. 

Corrective action resolution 

Appropriate corrective action was accomplished on all defi- 
ciencies reported on a NASA Failure Report Form. The corrective 
action was noted as concisely as- possible, yet amply detailed, and 
did denote the required positive action for the resolution of the 
problem areas. 

Review of corrective action activity 

Project representatives and R&QAO did jointly participate in 
periodic engineering review meetings. The purpose of these meet- 
ings was to resolve "open" failure and analysis reports, and to 
define rework, retest, and any additional action necessary to im- 
prove and maintain system reliability. A failure, analysis and 
action report was considered resolved when all concurrence signa- 
tures and dates appear in Section IV of the report. 
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Project summary charts 

Dot Diagrams were prepared by the Reliability Office for each sub- 
system# From these diagrams trouble spots can be readily identified and 
progress toward their solution observed. The pertinent summary informa- 
tion was transmitted to all interested groups. 

Performance goal 

This Project used as its performance goal a mean-time between- 
failures for each sub-system greater than 8 760 hours. 

The test data was subjected to weighted statistical analysis to 
ascertain attainment of the goal by each sub-system. 

R&QAO did periodically assess the current progress of each sub- 
system toward meeting the performance goal. 

Equipment log 

An equipment log and continuous history on the fabrication, inspec- 
tion, test, storage and assembly of flight, and prototype components was 
maintained. 

The interested reader can obtain more details on the SERT II re- 
liability and quality assurance provisions and procedures from reference 
11 . 


2.0 Reliability stress analysis of a microthruster power conditioner 
Obtaining suitable power-conditioning equipment for electric pro- 
pulsion units is widely recognized as a critical problem (ref. 12). 

Data have been accumulated on several electric propulsion research pro- 
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jects and other power- conditioning development contracts which further 
show that overstressed electrical parts are a prime cause of equipment 
failures in electric propulsion experiments. 

A typical example of this problem occurred- during the WASP fluid 
dynamic experiment. In this case the failure was in a 28 to 500 volt 
dc converter which was the power supply for a telemetry transmitter. 
Failure analysis showed that two, IN 684, subminiature silicon rectifiers 
had shorted out. Experimental measurements showed that the diodes were 
not carrying equal amounts of the applied reverse voltage. The other 
ratings for each diode appeared to be reasonable. The fact that these 
particular diodes were manufactured with avalanche reverse breakdown 
properties did not seem to be sufficient protection for long-term, 
reliable operation under these conditions (refs. 13 to 15). 

It is generally recognized that component -part failure rates are 
increasing functions of the stress applied in operation'. Furthermore, 
it is realized that even the best parts, when operated at maximum-rated 
stress levels, do not have sufficiently low failure rates to allow the 
synthesis of highly reliable complex systems. Therefore, the need to 
derate components in application is clearly established (ref. 16). 

Component derating factors are naturally based on the component 
reliability at various stress levels. Once the necessary component re- 
liability is established, the maximum stress level at which the component 
could be operated can be determined without violating the reliability 
requirement. Unfortunately, curves of reliability as a function of stress 



25 


exist for only a few components and are generally not well proyen even 
for these. In the remainder of the cases, historical information based 
on field data obtained from various equipment operating under conditions 
similar to those of interest must be used. 

Table V shows the recommended derating factors for power conditioners 
This table is based on experimental findings and a survey of the best in- 
formation currently available. Proper use of these derating factors 
should yield component failure rates in the range 0.1 to 0.001 percent 
per 1000 hours. Failure rates will also vary widely for different 
applications because of the particular circuit's tolerance of component 
drift. Therefore, to ensure low failure rates the designer should strive 
to achieve the greatest possible circuit tolerance. 

Discussion 

An electrical stress analysis test was performed on the microthruster 
power conditioner while it was operating into an adjustable resistive load 
bank. (For a more detailed explanation of the apparatus required to operate 
an ion thruster consult ref. 17). Transient simulation and measurement 
techniques were worked out. Detailed transient and steady-state data from 
these measurements are recorded in the microthruster equipment log on file 
at the Lewis Research Center. These data describe some of the response 
functions that were observed in the test apparatus under worst- case con- 
ditions and help explain why the overstress problems were occurring. 
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Reliability model 

The Lewis microthruster reliability model with the interconnection 
arrangement of the circuits with the thruster is shown in figure 3- 
Each solid-line box is a necessary component of the subsystem. The 
dashed line defines the subsystem boundaries. The power conditioner has 
27 circuits that are operated by a dc power source. These circuits 
change the primary power into the proper voltage and currents for the 
thruster heaters, the high-voltage electrodes, and signals of thruster 
parameters . 

Each component has been assigned an identification number or letter 
corresponding to the equation index n or j. Numbers were used to 
identify main component blocks. Lower-case letters were used for aux- 
iliary components. Two equations have been added to this diagram that 
describe (l) the theoretical reliability of the thruster equipment and 
(2) the theoretical reliability of the telemetry circuits. This diagram 
was used as 

(1) A basis for redundancy 

(2) A guide for reliability trade-offs 

(3) A guide for failure data reporting and analysis 

For a more complete treatment of the reliability model consult reference 18. 

Summary of findings 

A summary of the worst-case electrical stress analysis findings is 
given in table VI. The parts have been grouped into six categories. The 
microthruster power -conditioning equipment contained 523 electrical parts; 

52 of these parts had not been derated sufficiently to satisfy recommended 
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derating factors. None of these deficiencies were observed either by 
calculations or under normal operating conditions. It was necessary 
to investigate various operating conditions experimentally to find the 
highest stress conditions. Transients caused by turnon, step changes 
in parameters, simulated arcs, or turnoff were studied in the laboratory 
to define these problem areas. Each improper derating condition was 
analyzed. Corrective design changes were implemented into the bread- 
board model to eliminate the worst- case overstress conditions. 

Although the electrical stress analysis covered the entire micro- 
thruster power conditioner, this discussion is limited to one of the 
more interesting problems, that of the rectifier stresses. 

An examination of the data in table VII reveals that ten UTR 62 
rectifiers were overstressed. All of these rectifiers were in output 
indexes 15 and 16 in figure 3- Three IN 649 rectifiers were found to 
be overstressed in indexes 2, 14, and b in figure 3* One IN 746, two 
■IN 1616, two IN 2999B and eight FD 300 rectifiers were also overstressed, 
as shown in table VII. In most cases the overstress condition was 
reverse voltage. In all cases measurements were made for tv and tl 
to ensure proper derating under worst-case conditions. 

Schematic; of index 15 

Experimental data for all the electrical parts were obtained by 
making electrical measurements on the microthruster power- conditioning 
breadboard. Index 15 for the beam supply is the voltage quadrupler 
circuit shown schematically in figure 4. The input forcing function 
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V, . = V 0 . is a regulated -24 volts dc. This voltage is applied 
through an inverter alternately to each half of the primary of T9* 

The stepped-up output T. of T9 is used to charge four quadrupler 
capacitors, C^g to Cg 2 > connected through the rectifiers, CR^y 
to CR i i p, to generate +1600 volts dc output, Vg Q (Ref. 19)* The 
table in figure 4 shows the final trim capacitance values that were 
used in the stress -relieved beam supply. 

The UTR 62 rectifiers are alloy-diffused silicon devices. The 
fabrication process is controlled in such a manner as to optimize re- 
covery time. Past recovery time suggests that an abrupt junction model 
is appropriate for these devices. This model is used later to show 
why proper derating for reverse voltage (-V) is important for long- 
term reliability. 

Test apparatus 

The Major piece of test equipment used for these observations was 
an oscilloscope. One of the more interesting test apparatus setups 
used to measure rectifier voltage is shown in figure 5* A 200 to 1 
attenuator and voltage isolation probe was connected to the test 
specimen. A logarithmic-scale compression circuit was used to measure 
the rectifier voltages because of its dynamic range of 4 orders of 
magnitude. The circuit was sensitive to test apparatus loading. The 
differential probe had an input impedance of 30 megohms and 3 pico- 
farads, which appeared to give minimum circuit disturbance. The signal 
ratio V may / V mi ri was reduced from 600/0.8 to 3/0.004 by the probe. 
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This information is amplified by a factor of 10 to 30/0.04 and fed into 
logarithmic amplifiers for compression. The voltage across the test 
specimen was obtained by subtracting channel B from channel A. The diS' 
play device was the oscilloscope. 

Ground-loop noises were reduced by connecting the oscilloscope 
common with the power- conditioner- circuit common and isolating the 
oscilloscope from its power source. 

Unbalance and zero drift are critical adjustments in this de- 
coupled measurement technique. Proper attention must be given to each 
component to assure that it is calibrated, operating, and adjusted 
properly. Connecting channels A and B to the same point, as a check, 
assures cancellation of unwanted or interfering signals. It is diffi- 
cult to resolve ±V beyond about ±10 percent because of scale com- 
pression. However, for dynamic measurements on a system with this com- 
plexity, greater accuracy was not required. 

Experimental data 

Electrical stresses for rectifiers OR to CR^ at laboratory 
ambient temperature are shown in table VUE. The data show that +V, 

+1, and ¥ meet the requirements of table V. The measured data at 
laboratory ambient temperature (approx. 21° c) are compared with the 
specified spacecraft heat sink at a maximum of 60° C to obtain the com- 
ponent derating factor for these conditions. Some of the rectifier 
diodes have reverse voltage and current stresses, -V and -I, with 
derating factors of 1.0 and 12.5, respectively, which is considerably 
above the specified deratings. 
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A P-3SF junction is reverse recovered from the forward conducting 
state when the current passing through the junction goes to zero (i.e., 
righthand thermally generated hole current 1^ equals lefthand 
thermally generated electron current I ). F° r a mor e complete treat- 
ment of the theory of P-N junctions consult references 20 and 21. 

The junction current goes to zero by diffusion and drift, removing the 
majority carriers from the junction. At the instant of switching, a 
current spike occurs which was the cause for j-l| to exceed its dc 
rating by a factor of about 10. The energy rating of the rectifier is 
not exceeded by these repetitive reverse-current spikes and is, there- 
fore, not a major concern. 

Table VUIalso shows that the junctions were not sharing reverse 
voltage equally. The appendix reviews the current theory applicable to 
junction breakdown to show that equal -V sharing is important for 
rectifier reliability. For example, CR 10Q wou1 ^ off a potential 

of 600 volts while CR^g was carrying only 30 volts peak. Based on 
these observations, it was clear that reliability could be improved if 
the diodes shared the reverse voltage more equally. In our example, 
CRgj would pick up about five times more -V when CR 100 shorted out 
than if CR^g shorted out. After a time CR^, which no longer would 
be properly derated, could fail by this same junction deterioration 
phenomenon and thereby cause CR^g and CR^ to carry the remaining 
burden with no derating. Eventually all rectifiers would fail and the 
power- conditioner output would go to zero. 
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Most probably the part with the greatest electrical stresses will 
fail first. Past experience with diodes has shown that shorting is 
the dominant failure mode. If some method could be found to make all 
reverse potentials nearly equal, a derating factor of about 0.33 could 
be achieved, and the probability of junction deterioration breakdown 
occurring could be reduced. 

Conventional methods (refs. l4 and 15 ) were employed to improve 
reverse-voltage sharing as this could possibly have improved the long- 
term reliability of a series of rectifiers. The circuit stopped op- 
erating properly when these different methods were tried. 

'■Recognizing that equal C . terms should share -V equally, 

iJ 

three fixed trim capacitors were added to each string to meet the de- 
sired constraint |0.9 Vj < j -vj < jl.l Vj. In figure 4 the arrange- 
ment of trimmer capacitors and their values are shown. Table IX shows 
that quite an improvement in -V has been accomplished by adding the 
proper without affecting -I appreciably. The maximum spread on 

uncompensated reverse voltage of 17 to 600 volts peak has been reduced 
to 160 to 205 volts peak (compare table V 111 with table IX). 

Reverse voltage may have exceeded the desired tolerance by a small 
amount; however, the tolerance was primarily determined by the fixed 
values of mica capacitors available. Reverse current has been increased 
roughly by a factor of 2. This is not nearly enough to influence the 

energy rating W or circuit operating parameters. It remained to show 
that temperature would not adversely influence voltage sharing and that 
such a rectifier string would operate for a long time without failure. 
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Temperature data for tl and tv were taken by placing the 
rectifiers, CR^ to CR-^g, and - ^ r: * iia capacitors in a tempera- 

ture chamber. Ten temperatures spaced approximately 14° C apart in 
the range from -54° to 85° C were selected as test points. The test 
data for -I and *V does not show that temperature has any pro- 
nounced effect on the circuit response. Table IX summarizes the 
data for -V by giving the central value -V, and standard deviation 
cr, in the test temperature range. 

The mean value of reverse voltage varies from 162 with u = 7.7 
volts peak to 209 with a ■ 5.8 volts peak. Further consideration of 
figure 4 helps explain why temperature has not much influence on 
voltage sharing for this compensation method. The transformer T9 
has been optimized for weight, which tends to increase copper losses; 
copper, silicon, and mica all have positive changes in resistance, 
leakage, and capacitance, with temperature. When these two facts are 
considered, one explanation for this nominal temperature effect may be 
that as temperature increases the copper losses increase. At the same 
time the load impedance is decreasing, which tends to maintain a con- 
stant response function. Conversely, when temperature decreases the 
copper losses decrease and the load impedance increases, which tends to 

hold V/- constant . 

6,0 


Exhibited response 

The microthruster power -conditioning breadboard revised to eliminate 
high- stress areas was run in the laboratory without failure for 7052.3 


hours . 
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Conclusions and recommendations 

The worst- case electrical stress analysis test performed on a 
microthruster power- conditioning breadboard disclosed a number of 
electrical parts which were overstressed. Each overstressed part was 
analyzed to determine suitable corrective action. Corrective design 
changes were implemented into the breadboard model. 

Experimental measurements showed that a worst- case stress analysis 
obtained through laboratory testing is necessary to identify over- 
stressed conditions which are not evident from an analytical study or 
from subjecting the equipment to normal operating conditions. The 
rectifier diode problem is an example of a worst-case stress condition 
that was identifiable only through laboratory testing. As a result of 
this testing, the rectifier problem was solved by adding high-reliability 
mica capacitors across the rectifiers to improve the voltage sharing 
capabilities of this design. 

Breakdown theory shows that junction deterioration could have been 
the cause of several critical failures which have occurred on past ion- 
engine research projects. A further review of these breakdown theories 
showed that avalanche construction is not always the answer to ob- 
taining long-term reliable operation under a repeated transient condi- 
tion. 

An ion-thruster power conditioner was modified to eliminate the 
evidenced over-stressed conditions described herein. This power con- 
ditioner operated properly for more than 7000 hours. 
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APPENDIX - Junction Breakdown 

Presently there are two theoretical explanations as to how a P-N 
junction which has voltage applied in the reverse direction abruptly 
changes from high resistance to essentially zero. Figure 6 shows these 
two types of breakdown. Both types of breakdown have been observed on 
an oscilloscope in the laboratory. 

From the origin to point A, I appears to be following the 
theoretical diode equation (ref. 20), 


I 


= I, 


exp 



( 1 ) 


and 


I. = I + I 

S gp gn / 

From A to B, I is increased by a leakage component. From B to 
E, there are two apparent paths by which breakdown occurs. These 
paths B-C-E and B-D-E are sometimes referred to as the zener and 
Townsend breakdown paths, respectively. The actual breakdown mechanisms 
are not well understood as each theory does not fit exactly with the ob- 
served phenomena. 

The zener breakdown theory (ref. 22) postulates that the covalent 

bonds in the vicinity of the depletion are spontaneously disrupted by 

the high electric fields that exist in this region. The carriers made 

available by the disrupted bonds would add to I and I . For 

gP gn 



35 


high fields, large number of field carriers would be generated, lim- 
ited only by the external circuit resistance, taking I into the E-F 
or avalanche region (refs. 23 and 24). 

High fields are certainly present in P-N junctions under reverse 
bias conditions, as can be seen from the following simplified analysis. 
The experimentally studied rectifiers were UTR 62 devices with fast 
recovery time. Figure 7 shows an abrupt junction model which is appro- 
priate for these devices. Since x = + W 2 and i = 0 (fig. 7), 

a point of inflection occurs at x = 0 and £ is maximum (see ref. 20) 
therefore. 


i 


max 



W 


2 


For an abrupt junction. 



For silicon this becomes, 


I 


max 


6 . 3x10 



( 2 ) 


where 


P = 5*0 ft-cm 


'B 


V " 
eq 


V « V 
eq 
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Therefore, 

V B a | -v| = 200 volts 

and 

i = 3 - 98 x 10 ^ volts/cm 
max 

Even though this analysis is only approximate, it is clear that 
this is a very high field and spontaneous disruption of the covalent 
bonds is quite likely. However, due to the inability of this theory 
to explain some observable phenomena, it is no longer accepted as 
complete . 

The Townsend breakdown theory (ref. 25) develops the analog be- 
tween a gas discharge and a P-N junction breakdown. The reverse 
junction current is composed of thermally generated holes, electrons, 
and leakage (eq. (l) and fig. 6). When the applied junction potential 
is increased, from point B, -V increases the energy state to a point 
where the thermal carriers begin to experience ionizing collisions. 
Each ionizing collision contributes secondary holes and electrons to 
-I, beyond the leakage contribution. This causes carrier multiplica- 
tion to occur, as each ionized carrier may strike several atoms as it 
passes through the depletion zone. Depending on the magnitude of the 
applied potential -V, the number of ionizing collisions can cascade 

quite rapidly as shown along the path B-D-E (fig. 6). From point E 
upward, the number of carriers generated by collision is no longer a 
function of -V, as has been reached. The junction current is, 
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in the E-F region, again, only limited by the external circuit re- 
sistance. 

It can be seen that all P-N junctions •will avalanche at some 
potential. Whether this disturbance occurs along path B-D-E or 
B-C-E does not change the fact that this is a very high stress con- 
dition for any junction and can easily cause failure. It has been 
shown in the literature (refs. 13 to 15 ) that the instantaneous energy 
rating cannot be exceeded, or sudden failure by punch-through will 
occur. The fact that a particular P-N junction can operate in the 
E-F region under controlled conditions by virtue of avalanche con- 
struction does not give total assurance against deterioration due to 
repeated high reverse-voltage stresses . 

Elevating the temperature in which the junction operated aggra- 
vates the situation still further. Temperature causes I to in- 

D 

crease. For silicon, Ig increases about 1 order of magnitude for 

each 20 K. This increase would suggest that since the number of 

carriers has increased, the avalanche potential V. should decrease. 

& 

Here, both theories appear to be misleading, as in many cases the 
measured value of increases slightly with temperature. 

It appears that the Early effect (ref. 26) under certain condi- 
tions may cause deterioration in P-N junctions. This may explain 
why P-N junctions that were avalanche protected still suffered gradual 
deterioration as a result of high reverse-voltage stress. This poten- 
tially unreliable condition can be minimized by adding a small trimmer 
capacitor across each exposed junction to cause equalization of reverse 


voltage . 
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TABLE I. - TEST DATA FOR A MECHANICAL PART 


Ordered sample number 

K hr 

t 2 ^ 

(Khr) 2 

1 

60 

3600 

2 

65 

4225 

3 

68 

4624 

4 

70 

4900 

5 

75 

5625 

6 

75 

5625 

7 

80 

6400 

8 

83 

6889 

9 

85 

7225 

n = 10 

90 

8100 

Totals 

750 

57 213 


TABLE H. - CABLE TIME -TO -FAILURE DATA 


Ordered sample 
number 

Time -to - 
failure, 
hr 

Median 

rank a 

5% Rank a 

95% Rank a 

1 

1 100 

6., 7 

0.5 

25.9 

2 

1 890 

16. 2 

3.7 

39.4 

3 

2 920 

25. 9 

8.7 

50.7 

4 

4 100 

35.5 

15.0 

60.7 

5 

5 715 

45,2 

22. 2 

69.7 

6 

8 720 

54.8 

30. 3 

OO 

7 

12 000 

64.5 

39.3 

85.0 

8 

17 500 

74. 1 

49. 3 

91. 3 

9 

23 900 

83. 3 

60.6 

96. 3 | 

n = 10 

46 020 

93. 3 

74. 1 

99.5 


a From tables 2 , 5, and 15 of reference 7. 


















TABLE m. - PASCAL'S TRIANGLE 


FOR BINOMIAL COEFFICIENTS 


Sample 

Possible 

Binomial 

size 

failure 

coefficients 

1 

2 

1 

2 

3 

12 1 

3 

4 

1 \3 3 / 1 

n = 4 

5 

1 4 \6/ 4 1 


TABLE IV. - SPEED CONTROLLER 


TIME -TO - FAILURE DATA 


Ordered sample number 

Time -to -failure , 

hr 

1 

3 520.0 

2 

4 671.2 

3 

6 729. 3 

4 

7 010.0 

5 

8 510.2 

6 

9 250. 1 

7 

10 910.0 

8 

11 220. 5 

9 

11 815.6 

10 

12 226,4 

Total 

85 866.3 


Total 










TABLE V. -COMPONENT DERATING FACTORS FOR POWER CONDITIONERS 


Component 

Derating 

Component 

Stress 

Remarks 


factor a 

derating 






weighting factors 






X 

Y 




Capacitors 




Voltage 

The following equation establishes the derating 

Ceramic disc 

0.7 

— 

— 



factor for capacitors where values of X and 

Ceramic, low voltage 
. Glass: 

— 

0.5 

0.2 



Y are given: 

CYFR10 and CYFR15 

0.7 

— 

— 



C - C . 

Derating factor - X - 111111 (Y) 

CYFR20 and CYFR30 

.5 

— 

— 



^max “ ^min 

Porcelain 

— 

0.7 

0.2 




Mica 

— 

.7 

.2 



where 

Plastic film 

— 

.5 

.2 



C capacitance value of capacitor for 

Paper 


. 8 

. 1 



which derating factor is desired 

Metalized 

— 

.5 

.2 



Tantalum, solid 



.7 

.3 



C min smallest capacitance value available 

Tantalum, wet slug and foil 

0.7 

— 

— - 



with same case size and voltage 
rating as C 







C max largest capacitance value available 







with same case size and voltage 
rating as C 

Connectors, low voltage 

— 



Current 

Contacts shall be derated to 75 percent of 







rating for individual contacts. The average 
current rating from 1 to 15 contacts shall be 
decreased linearly to 20 percent. For more 
than 15 contacts the rating is 20 percent of the 
normal individual contact rating. The applied 
voltage between contacts or between contacts 
and shell shall not exceed 250 volts rms. 

Silicon diodes 






Current and voltage derating factors shall be 

Signal and switching 

0.6 

— 


+I 

applied simultaneously. 


.5 

— 

--- 

+V, 

-i 



.3 

— 

— 

w 


Power (I Q < 10A) 

.85 

— 

--- 

+1 



.5 

. 

— 

+v, 

-i 



.43 

— 

; ... 

w 


Power (10A <I Q <= 35A) 

.75 

— 

: 

+1 



.5 

— 

; 

+v, 

-i 



.38 

— 

... 

w 


Zener (power < 1W) 

.5 

— 

— 

Power 


Zener (1W < power < 50W) 

.5 


... 

Power 


Microcircuits 





Supply voltages may be reduced to effect lower 






power consumption, at the price of slower 


switching speeds and narrower noise-immunity 


margins. Allowable fan-out should be reduced 


for reliable operation. Operation over wide 


temperature ranges will generally result in 


decreased circuit margins and fan-out capa- 


bility. Operational stability may be improved 


if power -supply voltage tolerances are tight- 


ened, especially if the devices employ non- 
saturating circuitry. 

Relays 

0.3 



rSi-r.-RAn* 







Resistors 

Composition 






0.7 

— 






Film 

.4 

— 

— 




Wirewound power 

.5 

--- 

--- 




Wirewound precision 

.4 


... 




Transformers 

0.4 










Silicon transistors 

.25 

— 

... 

Power 

Voltage applied across any junction or group 







of junctions shall not exceed 50 percent of 
rated voltage. 


a Derating factor = Maximum stress for reliable operation 
Rated stress 
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TABLE VI. - SUMMARY OF WORST-CASE 
ELECTRICAL STRESS ANALYSIS 
RESULTS 


Component 

Total used 

Overstressed 3, 

Rectifiers 

167 

26 

Transistors 

84 

9 

Capacitors 

91 

10 

Resistors 

170 

2 

Transformers 

9 

4 

Relays 

2 

1 

Total 

523 

52 

1 


Percentage of parts overstressed, 


9.9 percent. 


TABLE VII. - OVERSTRESSED-RECTIFIER DETAILS 


Rectifier, 

CR 

Derating 

factor 3. 

m 

Index 
(fig. 1) 

81, 84, 101 

0.80 

UTR 62 

16 

85 

1.08 



16 

89, 93 

• 93 



16 

100, 108 

1.00 



15 

109 

.63 



15 

112 

.73 

>1 


15 

7 

.97 

IN 649 

2 

22 

1.74 


! 

b 

37 

5.18 


V 

14 

113, 114 

Spikes 

IN 1616 

10 

54 

• 97 

IN 746 

17 

8, 9 

• 79 

IN 2999B 

10 

14, 15 

Spikes 

FD 300 

4 

134, 135j 137 





11 

146, 147 





8 

165 

> 

r 

1 

r 

2 


3 * 

The specified derating factor for working inverse 
voltage as given in table I is 0.50. 
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TABLE VIII. - EXPERIMENTAL CIRCUIT DATA AT 
LABORATORY AMBIENT TEMPERATURE (21° c) 
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TABLE IS . - COMPENSATED, EXPERIMENTAL, 


RECTIFIER DATA 














TIME -TO -FAILURE (HOURS xUP) 


60 



Figure 1. - Lognormal life test diagram. 


PROBABILITY OF N f DEFECTS, f(N f ) 


1.00 



Figure 2. - Explosive bolts histogram. 
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Figure 3. - Microthruster reliability model with identifying devices. 
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Figure 5. - Apparatus setup for rectifier voltage. 






Figure 6. - Steady-state junction breakdown. 



Crystal dimension, x, cm 
Figure 7. - Abrupt Junction model. 
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